Rockwell Automation: Two Flaws Enable SYSTEM-Level Privilege Escalation via Malicious DLLs

CISA reported on September 1, 2026 two high-severity vulnerabilities in the Rockwell Automation Redundancy Module Configuration Tool, software distributed worldwide and also used in critical manufacturing environments.

The flaws, tracked as CVE-2026-9633 and CVE-2026-9634, allow a local user with limited privileges to prepare code execution as Administrator/SYSTEM. To complete the attack, however, an administrator must subsequently launch the vulnerable application.

These are therefore not vulnerabilities that can be exploited directly over the network. At the time of publication, there were also no known public campaigns specifically targeting these flaws.

Which Tool Versions Are Vulnerable

Both vulnerabilities affect Rockwell Automation’s Redundancy Module Configuration Tool, but involve different version ranges and executable files:

Vulnerability	Affected component	Vulnerable versions
CVE-2026-9633	RM3ConfigTool.exe	10.00.00
CVE-2026-9634	RMConfigTool.exe	From 9.00.00 through 10.00.00, inclusive

Rockwell Automation fixed both issues in version 10.01.00, which should therefore be treated as the target update for all affected installations.

The status of the affected products is listed as known_affected. Organizations should verify the version actually installed on engineering workstations rather than relying solely on centralized inventories, which may be outdated in industrial environments.

The Attack Exploits Writable Directories in the System Path

Both flaws fall under CWE-276 – Incorrect Default Permissions. The problem results from overly permissive default permissions combined with the way the executables search for a required DLL.

When they start, RM3ConfigTool.exe and RMConfigTool.exe search for the DLL in directories included in the system path. One or more of these locations may be writable by standard users, even though they are searched by an application that can run with elevated privileges.

An attacker who already has a presence on the machine but is restricted to a low-privilege account can therefore place a specially crafted DLL in an accessible directory. The code is not necessarily executed immediately.

Execution is triggered when an administrator opens the vulnerable tool. If the library search resolves to the file placed by the attacker, the DLL is loaded into the elevated process and its code runs with Administrator/SYSTEM privileges.

This is a form of local privilege escalation based on insecure library loading. It requires three conditions:

1. the attacker must be able to operate locally on the system;
2. the attacker must be able to write to at least one directory searched by the application;
3. an administrator must subsequently launch the vulnerable tool.

The privileged user interaction limits how quickly the attack can be carried out, but it does not reduce its impact once the chain is completed.

High Impact on Industrial Workstations

CISA assigns both vulnerabilities a CVSS v3.1 score of 7.3, rated High, with the following vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

The CVSS v4.0 score is 7.0, also rated High:

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

The vectors describe a low-complexity local attack that starts with limited privileges and requires action by a user with higher privileges. Successful exploitation can fully compromise the confidentiality, integrity, and availability of the vulnerable system.

The actual risk depends on the machine’s role. On an isolated workstation, the attacker primarily gains control of the operating system. On an engineering computer connected to automation networks, production assets, or control systems, the same privileges can become a starting point for operational changes, configuration theft, or lateral movement.

The vulnerability does not provide initial access on its own. However, it can turn a limited compromise—obtained, for example, through weak credentials, malware, or social engineering—into administrative control of the workstation.

No Known Public Exploitation and No KEV Deadline Listed

At the time of the report, there was no publicly known exploitation specifically targeting CVE-2026-9633 or CVE-2026-9634. The requirement for local access distinguishes these flaws from ICS vulnerabilities that can be reached directly through exposed network services.

The two CVEs are not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. As a result, no catalog inclusion date or associated federal remediation deadline has been specified.

This does not constitute a guarantee of safety. The technique is compatible with post-compromise activity, in which an intruder attempts to overcome the limitations of a compromised account without attracting attention.

No information has been disclosed about any recent Rockwell Automation entries in KEV relevant to this report. The two vulnerabilities should therefore be assessed based on the tool’s actual exposure and the privileges available on the systems where it runs.

Update to Version 10.01.00 and Apply Interim Controls

The primary mitigation is to install Redundancy Module Configuration Tool 10.01.00. Before updating—especially in industrial systems—CISA recommends conducting an environment-specific impact and risk assessment.

When the patch cannot be applied immediately, administrators should at least:

• identify all installations running versions from 9.00.00 through 10.00.00;
• restrict local access to workstations hosting the tool;
• check which directories in the system path are writable by standard users;
• remove unnecessary permissions after verifying operational compatibility;
• avoid running the application with administrative accounts until the system has been updated;
• apply Rockwell Automation’s security best practices.

No specific indicators of compromise have been published. Security teams can nevertheless look for DLLs created or modified by non-administrative accounts in directories searched by the vulnerable executables, as well as anomalous library loads by RM3ConfigTool.exe and RMConfigTool.exe.

It is also useful to correlate these events with the launch of the tool using administrative credentials and with the subsequent creation of unexpected processes. An unknown DLL does not by itself prove an attack, but its origin, signature, and load path should be investigated.

Segmentation and Defense in Depth for ICS Environments

CISA recommends keeping devices and control systems inaccessible directly from the Internet, placing them behind firewalls and separating industrial networks from corporate networks.

When remote access is essential, it should use more secure solutions, such as up-to-date VPNs. Authorized endpoints connecting through these systems must also be monitored and secured: a VPN does not neutralize the compromise of a remote device.

For this specific pair of flaws, segmentation does not prevent local DLL loading. It can, however, contain the consequences by reducing the ability of a compromised workstation to reach other production assets.

Organizations should also integrate this check into their incident response processes and report suspicious activity to CISA. Vendor alerts and updates are available on Rockwell Automation’s Security Advisories page.